yokai/enum-bundle

The package has clear licensing, a matching repository, repository tests, and release notes for this version. Maintenance has gone quiet, and the workflow uses nine unpinned actions without a security policy.

Latest v5.1.0

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed for over 9 years with 25 releases, but it has had no registry release in the last 12 months. The long history supports maturity, while the recent pause raises a maintenance concern.

Repo commit activity

There were no commits and no active maintainers in the last 3 months. With no registry releases in the last 12 months, this indicates currently quiet maintenance and increases abandonment risk.

Repo tooling

The repository uses Composer for builds, but no security scanning tools were detected. Build support is present; the missing scanning is a modest hygiene gap.

Security policy

No security policy was found in the repository. This reduces transparency about vulnerability reporting, though it is not evidence that the package is unsafe.

Workflow audit

The only workflow was fully analyzed with no high-confidence audit findings or untrusted checkout and script-injection paths. However, all 9 action references are unpinned, creating a supply-chain hygiene weakness; the missing top-level permissions block is not concerning on its own.